Computer-implemented procedure for access management and information technology system

Abstract

The invention relates to a computer-implemented method for authorization management.The computer-implemented method is characterized in that a computing unit (1) receives a rectification token (2) of a token-based authorization protocol, wherein the rectification token (2) includes authorization information for the use of a service, and wherein the computing unit (1) extracts the authorization information from the rectification token (2) and generates an authorization certificate (3) of a certificate-based authentication protocol from it; or the computing unit (1) receives an authorization certificate (3) of a certificate-based authentication protocol, wherein the authorization certificate (3) includes authorization information for the use of a service, and wherein the computing unit (1) extracts the authorization information from the authorization certificate (3) and generates an authorization token (2) of a token-based authorization protocol from it.

Description

The invention relates to a computer-implemented method for entitlement management and to an information technology system of the type defined in more detail in the preamble of claim 5.As digitalization increases, computing units are also increasingly installed in vehicles in order to perform the most diverse tasks there. The computing units can communicate with one another and with further electronic components, such as sensors. A field bus is usually used as the communication line in a vehicle, such as a CAN bus or an Ethernet data line. Typically, unified diagnostic services (UDS) are used as the communication protocol for the diagnosis of control units. UDS is specified by ISO 14229. A computing unit, which is also referred to as a client or tester in this context, can be connected to the bus system of the vehicle via a so-called diagnostic interface. This makes it possible to read out the error memory of the control units or to play a new firmware onto the control units. However, this process requires physical access to the vehicle in order to be able to connect the tester to the diagnostic interface. Remote maintenance is thus not possible, and a high level of effort is also required for a person carrying out the diagnosis.Information technology systems are generally susceptible to cyber attacks and should be secured accordingly. This is particularly important for in-vehicle systems, in particular, since the safe operating behavior of the vehicle can be endangered when in-vehicle computing systems are manipulated, and sensitive data, such as personal data, can be learned. These include, in particular, data which make it possible to reconstruct the movement profile of the vehicle.A wide variety of cryptographic protection measures are known for protecting the communication between computing systems. In this context, asymmetric encryption methods are mentioned in particular, which allow the transmission of digitally signed and encrypted messages. With the aid of digital certificates, the authenticity of a public key and its permissible application and scopes are confirmed. The digital certificate is itself protected by a digital signature. The signature of the certificate can be checked by means of the public key of the issuer of the certificate. The information technology infrastructure used for generating and managing digital certificates is also referred to as public key infrastructure (PKl). Relevant components of a PKI are in particular the certification authority (CA) which provides the certificate and accepts the signature of certificate requests, the so-called registration authority (RA) in which entities such as persons or machines can request certificates, and the so-called validation service (VA) which enables the checking of certificates in real time. A common standard for creating digital certificates is X.509. X.509 certificates find application in, for example, TLS-encrypted data transmission, such as when web pages are retrieved using https connection. Bidirectional certificate-based authentication is possible in the vehicle context using the UDS service $29 "authentication". X.509 certificates can also be used for this purpose.To increase cybersecurity, protocols for enabling standardized and secure API authorization for computer-based applications are also known. In this context, OAuth 1.0 and OAuth 2.0 may be mentioned. With the aid of OAuth, in particular OAuth 2.0 with the inclusion of OpenlD Connect, end users are enabled to enable applications, also referred to as "clients", to access a service or data which are provided from another location, usually referred to as "resource servers". At this time, the end user does not need to pass user login information such as a user name and a personal password. This prevents the application wishing to access the end user's data from being able to use the service or data provided by the other location without restrictions. Thus, the application can use the service or access the data only within the scope of the authorisation granted by the end user. The authorisations granted by the end user are stored and transmitted in the form of a token. The scope of permissions stored in such a token is also referred to as a "scope.". There is a relationship which authorizes the owner of the token to access which data of the end user. This relationship is also referred to as "mapping". An application, for example a first service for printing photos, can present a second service or the resource server, for example a cloud service for storing photos, with a corresponding authorisation token which then grants the application, for example, access to a specific photo album of the end user. Thus, the end user does not have to pass his login data for the cloud service to the application in order to be able to print vacation photos stored in the photo album, for example. Thus, the application cannot misutilize the second service.The OAuth framework is disclosed in patent form by WO 2013 / 049461 A2.For a vehicle manufacturer, it is desirable to be able to carry out a vehicle diagnosis also remotely. This would eliminate the need for a respective vehicle to first visit a workshop. However, this involves the question of how the cybersecureness can be maintained seamlessly in the communication between a user, that is to say for example a vehicle developer or a service person, and the control units in the vehicle.The object of the present invention is to provide methods and means which enable such seamless maintenance of secured communication.According to the invention, these objects are achieved by a computer-implemented method for entitlement management having the features of claim 1 and by an information technology system having the features of claim 5. Advantageous embodiments and further developments are evident from the claims dependent thereon.According to the invention, a computer-implemented method for entitlement management provides thata processing unit receives a correction token of a token-based authorization protocol, wherein the authorization token comprises authorization information for using a service, and wherein the processing unit extracts the authorization information from the authorization token and generates an authorization certificate of a certificate-based authentication protocol therefrom; orthe processing unit receives an authorisation certificate of a certificate-based authentication protocol, wherein the authorisation certificate comprises authorisation information for using a service, and wherein the processing unit extracts the authorisation information from the authorisation certificate and generates an authorisation token of a token-based authorisation protocol therefrom.The computer-implemented method for entitlement management according to the invention thus enables seamless translation between token-based authorisation protocols and certificate-based authentication protocols. The transmission is possible in both directions. This makes it possible to seamlessly secure a communication path from a first entity to a second entity against cyber attacks, wherein the first entity is connected via a communication network which is based on a token-based communication and the second entity is connected to a communication network which is based on a certificate-based communication protocol. The computing unit serves as a switch between the two entities and is connected to both communication networks. These may be communication networks which are physically separated from one another or else a purely logical separation, corresponding data packets then being sent via the same physical data line.The service to be used can be provided by the first entity or the second entity, depending on the communication direction. In the extended sense, "service" means the use of a functionality provided by a computing system and / or the access of computer-readable data held by the computing system. For the translation between the token-based communication protocol and the certificate-based communication protocol, the computing unit executes a computer program product provided specifically for this purpose. The computer program product is stored on a computer-readable storage medium to which the computing unit has at least read access. Corresponding code components are executed by an execution unit of the computing unit, for example a processor such as a CPU.The computing unit may have dedicated hardware components which can be used to provide the computer-implemented method according to the invention. However, common resources can also be used, which are also used to provide other functions. In addition, additional security measures can be implemented in the computing unit, such as a firewall, an intrusion detection and prevention system (IDPS), and the like.The computing unit is configured to "translate" between the respective communication protocols. For this purpose, the computing unit can have a corresponding translation database. This translation database then contains rules which have to be converted into structures or contents of the respective communication protocol in what way in order to be able to be used by the other communication protocol. This translation database can preferably be part of the computer program product used for executing the method according to the invention. The translation database can also be stored in a separate memory. The term "translation database" can also be interpreted abstractly, so that no database is actually present, but corresponding rules or relationships are implemented in a different manner.An advantageous development of the method according to the invention provides that OAuth 2.0 is used as token-based authorization protocol, in particular with inclusion of OpenID Connect, and / or the authorization certificate is designed as an X.509 certificate. These are communication protocols that are used particularly frequently, which ensures broad application or implementation of the method according to the invention.According to a further advantageous embodiment of the method according to the invention, authorisation tokens are exchanged between the computing unit and a superordinate IT infrastructure via an https connection and / or authorisation certificates are exchanged between the computing unit and a subordinate IT infrastructure unit via a unified diagnostic services connection according to ISO 14229. The https protocol is widely used for exchanging messages between web-based applications. The IT infrastructure superordinate to the computing unit is preferably a cloud environment. The cloud environment may include one or more servers or server clusters. The cloud environment can likewise be contacted by a terminal device such as a desktop computer or else a mobile terminal device such as a smartphone, tablet computer or laptop computer. A corresponding server and / or also a terminal connected to the cloud environment can form an entity.As already mentioned at the beginning, the UDS protocol is used for transmitting diagnostic messages via a field bus system of a vehicle. The IT infrastructure unit subordinate to the computing unit is thus in particular an on-board computing unit such as a control device. The computing unit for translation between the two communication protocols can then be provided outside the vehicle or else inside the vehicle, as long as a connection to both communication networks is ensured.Thus, authorisation tokens transmitted via an https connection can be converted into authorisation certificates transmitted via a UDS data line and vice versa.In this case, the authorisation certificate is preferably used to authenticate an entity for using the service by means of the UDS service $29 authentication. This is a special routine or service of the UDS communication protocol. The service "authentication" or "authentication" with the SID $29 or 0x29 provides modern methods for bidirectional authentication using a PKI or also a so-called challenge-response-authentication-based certificate transmission. At least parts of the PKI are particularly preferably implemented in the IT infrastructure higher-order to the computing unit. At least parts of the PKI may also be vehicle-integrated.In an information technology system comprising a computing unit configured to execute a method described above, the computing unit is integrated into a vehicle according to the invention. Using the method according to the invention, the information technology system allows seamless secured end-to-end communication between a first and a second entity. The first entity is preferably part of the IT infrastructure superordinate to the computing unit or is in communication connection with the superordinate IT infrastructure. The second entity can likewise be part of the vehicle or else external thereto. In a particularly advantageous embodiment, which will be discussed in more detail below, the second entity is formed by a control device of the vehicle. In this context, the second entity is also referred to as an IT infrastructure unit subordinate to the computing unit.The computing unit is preferably designed as a telecommunication unit. A telecommunication unit, also referred to as a telecommunication unit (TCU), allows the vehicle to be connected to the Internet. For this purpose, wireless communication can be based on mobile radio or Wi-Fi, for example. The program routine used for the purpose of the computer-implemented method according to the invention for entitlement management, i.e. an application provided by execution of the already described computer program product, is therefore executed on the telecommunication unit itself. The information exchanged during the communication between the first and second entities is thus translated within the direct communication path, which further improves the cybersecurity. If the computing unit were designed externally to the telecommunication unit, then corresponding authorization information would first have to be forwarded from the telecommunication unit to the computing unit, translated there and then added to the respective downstream second entity. The more components the vehicle-integrated computer system has, for example in the form of computing units and interfaces, the more possible attacks are also available to a potential attacker. This risk can thus be reduced. Furthermore, the integration of the functionalities which can be provided by the computing unit into the telecommunication unit increases the efficiency of the method according to the invention. Since no authorization information need to be transmitted first from the telecommunication unit to a computing unit external thereto, latencies in the data transmission can be reduced.According to a further advantageous embodiment of the information technology system according to the invention, an IT infrastructure unit subordinate to the computing unit is formed by a vehicle control device. It is thus possible for the first time to remotely service vehicle-implemented computing units such as vehicle control devices by means of UDS. Thus, an end user such as a vehicle developer or service person can exchange information with the vehicle control devices via the cloud portal of the vehicle manufacturer. This makes it possible, for example, to read out a fault memory, to execute a diagnostic routine on a vehicle control unit and / or to flash a vehicle control unit with a new firmware. For this purpose, the vehicle then no longer has to visit a workshop, which improves the comfort for the vehicle owner, shortens maintenance times and thus reduces costs.A further advantageous embodiment of the information technology system according to the invention further provides that the computing unit is configured to issue a request for using the service itself, to receive it from a subordinate IT infrastructure unit and / or to receive it from a superordinate IT infrastructure. This allows a particularly reliable execution of the computer-implemented method for entitlement management according to the invention. An end user who wishes to use the service can thus be located within the vehicle or else externally thereto. The advantages of the information technology system according to the invention and of the computer-implemented method according to the invention for authorisation management for vehicle-external access have already been explained. There are cases, however, in which the end user is also located in the vehicle and wishes to carry out corresponding diagnoses, for example during a frequent maintenance of the vehicle such as an inspection. By carrying out the method according to the invention, the computing unit, in particular in the form of the telecommunication unit, itself functions as a diagnostic tester. The end user therefore does not have to connect a separate diagnostic tester to the bus system of the vehicle via a corresponding diagnostic interface, but rather only has to log on to the cloud service of the vehicle manufacturer with his user information, which may be possible via a human-machine interface of the vehicle. This allows rapid, reliable and comfortable maintenance of the vehicle. In this case, a respective command for making the request can be issued manually by an end user or else automatically by a program.Preferably, the computing unit is configured to receive an authorisation token from the IT infrastructure as a response to the request, to convert the authorisation information contained therein into an authorisation certificate and to transmit this to the IT infrastructure unit for use of the service. The end user, for example said vehicle developer or service person, can have a personal user account in the cloud infrastructure of the vehicle manufacturer. Access rights for various in-vehicle services are associated with the user account, which authorizes the end user to carry out corresponding diagnostic routines. The end user can log on to the cloud infrastructure of the vehicle manufacturer, for example, via the infotainment system of the vehicle or else via a terminal such as a desktop computer, a smartphone, a tablet or the like, and thus instruct, via a corresponding input mask, via API, to use the corresponding service in the vehicle, that is to say, for example, to initiate a diagnostic routine of a vehicle control device, to read out a fault memory, to update firmware or the like.Up to now, there have been no corresponding access rights of the end user in the vehicle itself. Using OAuth2.0 in conjunction with OpenlD Connect, however, after the request for use of the service has been made, corresponding authorisation tokens for the end user are generated or called up by the cloud infrastructure of the vehicle manufacturer and transmitted via https connection to the computing unit in the vehicle or the telecommunication unit. The processing unit then translates the authorization information contained in the authorization token into a corresponding authorization certificate which is used for the UDS service $29 authentication. This makes it possible to transmit the corresponding access rights of the end user from the cloud into the vehicle and use them there for providing the requested service. Thus, seamless end-to-end secured communication between an off-vehicle entity and an on-vehicle entity is ensured. This procedure is also very flexible and allows the end user to easily use different services in a wide variety of vehicles, since the authorisations suitable for the respective application are reliably obtained from the cloud.Further advantageous embodiments of the computer-implemented method according to the invention for entitlement management and of the information technology system according to the invention also result from the exemplary embodiment which is described in more detail below with reference to the figure.FIG. 1 shows a highly schematic representation of an information technology system according to the invention.FIG. 1 shows an information technology system 7 according to the invention, which allows secure end-to-end communication between a superordinate IT infrastructure 4 and a subordinate IT infrastructure unit 5. A vehicle 8 is shown, comprising a plurality of vehicle control devices 10, which are connected to a computing unit 1 via a field bus 11. Particularly preferably, the computing unit 1 is formed by a telecommunication unit 9, which executes a computer-implemented method for entitlement management according to the invention. The telecommunication unit 9 is in communication connection with the IT infrastructure 4 in the form of a cloud or a backend of a vehicle manufacturer. Likewise part of the superordinate IT infrastructure 4 are an identity provider 12, also referred to as an identity provider (IDP), and an authorisation service 13 for the UDS service $29 authentication. The identity provider 12 provides the authorization information of an end user for the use of a service. The identity provider 12 is capable of providing the authorisation information in the form of an authorisation token 2. The authorization information is present in the authorization service 13 in a form interpretable for the generation of an authentication for the UDS service $29.In order to use a UDS service of a vehicle control device 10, it may be necessary to assign corresponding usage rights in the form of an authorisation certificate 3. The communication in the vehicle 8 between the computing unit 1 or the telecommunication unit 9 and the respective vehicle control devices 10 is thus based on a certificate-based authentication protocol. This is indicated by the authorisation certificate 3 shown on the left next to the vehicle 8 in the figure and by a dashed line running above it. In order to check the certificate or the authorisation, a respective vehicle control device 10 can provide a so-called access control list.The procedure known from the prior art provides for the manual connection of a so-called diagnostic tester to a diagnostic interface in the vehicle 8. Corresponding authorisations are held in the diagnostic tester in the form of respective certificates. However, this requires the use of a corresponding diagnostic tester, and physical accessibility to the vehicle 8 must also exist.Authorization information is transmitted between the computing unit 1 or the telecommunication unit 9 and the superordinate IT infrastructure 4, as well as between the respective components of the IT infrastructure 4 itself, via a token-based authorization protocol. This is indicated by the authorisation token 2 illustrated in FIG. 1 and the dashed line running below it.Communication with the superordinate IT infrastructure 4 is possible for an end user by means of a desktop computer 14, a mobile terminal in the form of a smartphone 15, a laptop 16 or the like. This allows the end user, for example a vehicle developer, a service person or generally also a vehicle owner, to execute a corresponding diagnostic routine for a vehicle control device 10 remotely. Thus, the desktop computer 14, the smartphone 15 and the laptop 16 form an entity 6, the authorization of which is to be checked by means of authentication for use of the service. A corresponding end user can also be located in the vehicle 8 and initiate the diagnostic service, for example via the infotainment system of the vehicle 8. In this context, the computing unit 1 or else a vehicle control device 10 can likewise form such an entity 6. It is also conceivable to execute corresponding diagnostic routines in an automated manner. The method according to the invention can therefore run completely automatically, with the result that corresponding authorisation information for using the service is automatically requested by the superordinate IT infrastructure 4. In this case, the IT infrastructure 4 and the said computing unit 1 and vehicle control devices 10 can also form such an entity 6.The computing unit 1 provides a computer program product, the execution of which by an execution unit such as a processor allows the provision of an authorization management application 17. The authorisation management application 17 makes it possible to provide a computer-implemented method for authorisation management according to the invention. The following example illustrates the operation:An end user or an application of the superordinate IT infrastructure 4 or an application executed in the vehicle 8 uses existing token-based authorization protocols such as OAuth 2.0 in combination with OpenlD Connect 1.0 to obtain an authorization token 2 which contains UDS diagnostic permissions in the form of scopes. These diagnostic permissions may be considered or designated as permission information. The respective application executed on the IT infrastructure 4 or in the vehicle 8 establishes a so-called API request in the vehicle in the telecommunication unit 9 and authorizes itself there with the authorization token 2.The authorisation management application 17 now checks the authorisation information contained in the authorisation token 2 and from this issues a new authorisation for the use of corresponding UDS services. The communication in the vehicle 8 takes place on the basis of a certificate-based communication protocol. Correspondingly, the computing unit 1 creates an authorisation certificate 3 which contains the authorisation information. This is then used for the $29 Authentication UDS service. In particular, it is an X.509 certificate.By means of the authorisation certificate 3, the respective end user or, in the case of an automatically running routine, an application can authenticate itself at the respective vehicle control device 10, which is to be used for providing the service.This makes it possible for the identity provider 12 and the authorisation service 13 to be transmitted to the vehicle 8 in a conceptual manner, as indicated by an identity provider 12* and authorisation service 13* shown in dashed lines. In this case, there is a trust relationship between these certification bodies, on the one hand for issuing or signing corresponding authorisation tokens 2 and on the other hand for issuing or signing corresponding authorisation certificates 3.After successful authentication of the end user in the vehicle control device 10, the respective vehicle control device 10 deems the end user or the application to be authorized to use the service.This enables the vehicle control device 10 to execute a command received from the cloud or the IT infrastructure 4 with sufficient authorization.One possible use case is as follows: an end user with the required authorization would like to execute an exhaust gas aftertreatment diagnostic routine via UDS on a specific vehicle out of the cloud. The end user is registered in the cloud and has corresponding diagnostic permissions. Corresponding information is stored in the identity provider 12. Now the end user starts the execution of the service. For this purpose, the end user can use, for example, said desktop computer 14, smartphone 15 or laptop 16. The authorization of the end user is converted by the computing unit 1 into a UDS Service $29 authorization in the form of the authorisation certificate 3. For this purpose, the IT infrastructure 4 first transmits a corresponding authorization token 2 to the computing unit 1. The authorization is then checked in the vehicle control device 10 and the exhaust gas aftertreatment diagnostic routine is executed.References included in the specificationThis list of documents cited by the applicant has been produced in an automated manner and is only included for the better information of the reader. The list is not part of the German patent application or utility model application. The DPMA does not take any adhesion for any faults or omissions.Patent Literature citedWO 2013 / 049461 A2

[0006]

Claims

Computer-implemented method for authorisation management, characterised in that - a computing unit (1) receives a correction token (2) of a token-based authorisation protocol, wherein the authorisation token (2) comprises authorisation information for using a service, and wherein the computing unit (1) extracts the authorisation information from the authorisation token (2) and generates an authorisation certificate (3) of a certificate-based authentication protocol therefrom; or - the computing unit (1) receives an authorisation certificate (3) of a certificate-based authentication protocol, wherein the authorisation certificate (3) comprises authorisation information for using a service, and wherein the computing unit (1) extracts the authorisation information from the authorisation certificate (3) and generates an authorisation token (2) of a token-based authorisation protocol therefrom.Method according to Claim 1, characterized in that the token-based authorization protocol OAuth 2.0 is used, in particular with the inclusion of OpenlD Connect, and / or the authorization certificate (3) is designed as an X.509 certificate.Method according to Claim 1 or 2, characterized in that authorisation tokens (2) are exchanged between the arithmetic unit (1) and a superordinate IT infrastructure (4) via an https connection and / or authorisation certificates (3) are exchanged between the arithmetic unit (1) and a subordinate IT infrastructure unit (5) via a unified diagnostic services connection according to ISO 14229.Method according to Claim 3, characterized in that the authorisation certificate (3) is used to authenticate an entity (6) for use of the service by means of the UDS service $29 authentication.Information technology system (7) comprising a computing unit (1) configured to carry out a method according to one of Claims 1 to 4, characterized in that the computing unit (1) is integrated into a vehicle (8).Information technology system (7) according to claim 5, characterised in that the computing unit (1) is designed as a telecommunication unit (9).Information technology system (7) according to Claim 5 or 6, characterized in that an IT infrastructure unit (5) subordinate to the arithmetic unit (1) is formed by a vehicle control device (10).Information technology system (7) according to one of Claims 5 to 7, characterized in that the arithmetic unit (1) is configured to issue a request for use of the service itself, to receive it from a subordinate IT infrastructure unit (5) and / or to receive it from a superordinate IT infrastructure (4).Information technology system (7) according to Claim 8, characterized in that the arithmetic unit (1) is configured to receive an authorisation token (2) from the IT infrastructure (4) in response to the request, to convert the authorisation information contained therein into an authorisation certificate (3) and to transmit this to the IT infrastructure unit (5) for use of the service.

Images